feat: DingTalk attendance import + integration config + expense types + UI polish

Server:
- Add DingTalk attendance import service with SSE progress streaming
- Add IntegrationConfig entity & module for multi-tenant DingTalk setup
- Add ExpenseType entity & ExpenseTypesModule
- Add SeedModule for DB initialization
- Add UserDingMapping entity for DingTalk user linkage
- Attendance service: import flow with dedup & student auto-mapping
- Rooms service: time-range overlap queries
- Sync controller/service: DingTalk integration wiring
- Permission guard: refactor to pure re-export
- Campus scope middleware: tenant-aware filtering

Admin UI:
- Attendance page: import UI with progress & result summary
- All pages: tableStyle/tablePagination standardization
- Login page: responsive styling
- Sensitive data: useViewSensitive hook for masked viewing
- Vite config: path aliases, build optimization
- Test infra: vitest config, test utilities

Docs: PRD DingTalk batch 1 & 2 design docs

apps/server/src/sync/sync.controller.ts

@@ -1,4 +1,4 @@
-import { Controller, Get, Post, Query, UseGuards } from '@nestjs/common';
+import { BadRequestException, Controller, Get, Post, Query, UseGuards } from '@nestjs/common';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';
 import { RequirePermission } from '../auth/decorators/permission.decorator';
 import { SyncService } from './sync.service';
@@ -11,8 +11,12 @@ export class SyncController {
 
   @Post('trigger')
   @RequirePermission('sync:trigger')
-  async triggerSync(@Query('platform') platform?: SyncPlatform) {
-    const logs = await this.syncService.triggerSync(platform);
+  async triggerSync(
+    @Query('platform') platform?: SyncPlatform,
+    @Query('rootDeptId') rootDeptId?: string,
+  ) {
+    const rootId = rootDeptId ? this.parseRootDeptId(rootDeptId) : 1;
+    const logs = await this.syncService.triggerSync(platform, rootId);
     return { synced: logs.length, logs };
   }
 
@@ -27,6 +31,15 @@ export class SyncController {
     };
   }
 
+  /** 获取钉钉组织部门树，供前端选择同步起点 */
+  @Get('dingtalk/org-tree')
+  @RequirePermission('sync:read')
+  async getDingTalkOrgTree(@Query('rootDeptId') rootDeptId?: string) {
+    const rootId = rootDeptId ? this.parseRootDeptId(rootDeptId) : 1;
+    const tree = await this.syncService.getDingTalkOrgTree(rootId);
+    return { success: true, data: tree };
+  }
+
   @Get('logs')
   @RequirePermission('sync:read')
   async getLogs(
@@ -35,4 +48,12 @@ export class SyncController {
   ) {
     return this.syncService.getLogs(platform, limit ? Number(limit) : 50);
   }
+
+  private parseRootDeptId(rootDeptId: string): number {
+    const parsed = parseInt(rootDeptId, 10);
+    if (isNaN(parsed)) {
+      throw new BadRequestException('rootDeptId must be a valid integer');
+    }
+    return parsed;
+  }
 }